Since 3.9 RC upgrade, we're seeing the following messages in the event log:
| 2/9/2012 8:45 AM |  | The NetFlow Service on host [US-DAL-NET01] is receiving an unsupported flow type from device ukfarpip.infor.com(10.7.0.16). Configure the specified device to send a supported Orion NTA flow type as listed here. | |
| 2/9/2012 8:45 AM | | The NetFlow Service on host [US-DAL-NET01] is receiving an unsupported flow type from device Corporate-7200.ntwk.lawson.com(10.251.0.21). Configure the specified device to send a supported Orion NTA flow type as listed here. | |
| 2/9/2012 8:44 AM | | The NetFlow Service on host [US-DAL-NET01] is receiving an unsupported flow type from device ukfardmvpn.infor.com(10.7.0.17). Configure the specified device to send a supported Orion NTA flow type as listed here. |
These systems are setup with standard flow-export configuration and have been sending Netflow data to Orion for a couple of years. Router config is:
ip flow-cache timeout active 1
ip flow-export source FastEthernet0/0
ip flow-export version 9
ip flow-export destination 10.33.0.33 9995
ip flow-top-talkers
We're also getting message kickbacks from ASAs configured according to the SW KnowledgeBase doc and from Cat6500s also configured according to SW docs:
| 2/8/2012 3:32 PM |  | NetFlow Receiver Service [US-DAL-NET01] did not receive a valid NetFlow V9 template with ID 261 with which to decode NetFlow data from device 10.38.128.6. Ensure the template has correct fields and is being exported at 1-minute intervals. | |
| 2/8/2012 3:32 PM | | NetFlow Receiver Service [US-DAL-NET01] did not receive a valid NetFlow V9 template with ID 261 with which to decode NetFlow data from device 10.38.128.5. Ensure the template has correct fields and is being exported at 1-minute intervals. | |
| 2/8/2012 3:32 PM | | NetFlow Receiver Service [US-DAL-NET01] did not receive a valid NetFlow V9 template with ID 261 with which to decode NetFlow data from device 10.33.0.3. Ensure the template has correct fields and is being exported at 1-minute intervals. | |
| 2/8/2012 3:32 PM | | NetFlow Receiver Service [US-DAL-NET01] did not receive a valid NetFlow V9 template with ID 261 with which to decode NetFlow data from device 10.38.0.3. Ensure the template has correct fields and is being exported at 1-minute intervals. | |
| 2/8/2012 3:17 PM | | The NetFlow Service on host [US-DAL-NET01] is receiving an unsupported flow type from device nlbarcore2-rsm(10.21.0.11). Configure the specified device to send a supported Orion NTA flow type as listed here. | |
| 2/8/2012 3:17 PM | | The NetFlow Service on host [US-DAL-NET01] is receiving an unsupported flow type from device nlbarcore1-rsm(10.21.0.10). Configure the specified device to send a supported Orion NTA flow type as listed here. |
Hi,
do you see data from these devices as before, or is flow collection broken after the upgrade?
The first messages informs that flow of unsupported type was received, typically NetFlow v1/v7 or sFlow v2. The other message warns about missing NetFlow v9 template - NTA is then unable to decode flow.
To answer why these were shown would require deeper look. I would recommend you open support ticket, so we can investigate.
Regards,
Martin
Got the same issue on one of our sources. This one generating sFlow.
2/10/2012 8:59 PM The NetFlow Service on host [ORION] is receiving an unsupported flow type from device 3500yl-24G J8692A. Configure the specified device to send a supported Orion NTA flow type as listed here.
Not an ASA but as with gnewt, this node has been sending flow to NTA for a long time without any issues, ever.
Hi,
Do you see traffic from this node? Can you please also open support ticket, so we can take deeper look?
Thanks,
Martin
We are still investigating the root cause. These are events that were not exposed in the previous versions (were in logs but not UI).
